New User Account Creation Attempt Via ADSI

William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)

Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".

2026-08-13 00:00:00

None

e50d5d26-0cf6-4045-b82b-13c0a4e316be

attack.persistence attack.t1136.001 attack.t1136.002

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #6228 from @swachchhanda000 - Add 2 new rules for user creation via adsi

2026-08-19